Login
Critical Vulnerability in Advanced Custom Fields: Extended Plugin Puts 100,000 WordPress Sites at Risk
21 January 2026 at 09:40
Unauthenticated Privilege Escalation Threatens WordPress Sites
The vulnerability could allow unauthenticated attackers to register new user accounts with administrator-level privileges, potentially giving them complete control over affected WordPress sites. Since no prior access or compromised credentials are needed, the exposure is far higher than typical privilege escalation flaws that require existing user permissions. Any site running a vulnerable version of the plugin with certain configurations in place could be targeted by attackers anywhere on the internet. The Advanced Custom Fields: Extended plugin is widely used by WordPress developers and site owners to enhance how custom fields operate. As an ACF add-on plugin, it provides tools for managing front-end forms, creating options pages, defining custom post types and taxonomies, and customizing the WordPress admin interface.How the ACF Addon Plugin Flaw Works
The issue lies in the privilege escalation vulnerability caused by missing role restrictions during user registration. Specifically, the plugin’s insert_user function does not enforce limits on which WordPress roles can be assigned when a new account is created. Under normal circumstances, WordPress strictly controls role assignment during registration to prevent unauthorized privilege elevation. In this case, that safeguard was bypassed. Exploitation requires that the site uses a front-end form provided by the plugin, and that the form maps a custom field directly to the WordPress user role. When this configuration exists, the plugin accepts the submitted role value without verifying whether it is permitted. Essentially, the plugin relied on the HTML form to restrict role selection, without performing proper server-side validation. For example, a developer might configure a registration form to display only the “subscriber” role. However, an attacker could inspect the form’s HTML, intercept the HTTP request, and modify the submitted value from role=subscriber to role=administrator. The plugin would then pass this value directly to WordPress’s user creation functions without validation, granting full administrator access. The plugin changelog confirms that these issues have been addressed. Fixes include:- “Enforced front-end fields validation against their respective ‘Choices’ settings.”
- “Module: Forms – Added security measure for forms allowing user role selection.”
Patches, Updates, and Steps for Site Owners
The vulnerability affects all versions up to and including 0.9.2.1. It has been patched in version 0.9.2.2, which introduces multiple validation hooks and enhanced security checks for front-end forms and user role handling. Notable updates in the changelog include:- Module: Forms – Enforced front-end fields validation against their respective ‘Choices’ settings
- Module: Forms – Added security measure for forms, allowing user role selection
- Module: Forms – Added acfe/form/validate_value hook to validate fields individually on the front
- Module: Forms – Added acfe/form/pre_validate_value hook to bypass enforced validation
